Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Eric Tooley
How exposed is your code? Find out in minutes—for free
Home / Security / Application security The new Code Security Risk Assessment gives you a one-click view of vulnerabilities across your organization, at no cost. & April 14, 2026 | 4 minutes Share: Most security leaders share the same suspicion: there are vulnerabilities in our codebase that we don’t know about. The uncomfortable truth is that most code never gets a thorough security review.
Found means fixed: Secure code more than three times faster with Copilot Autofix
Home / News & insights / Product With Copilot Autofix, developers and security teams can keep new vulnerabilities out of code and confidently remediate their backlog security debt. August 14, 2024 | 7 minutes Share: Developers are shipping software faster than previously imaginable, releasing new features early and often. Yet despite their best efforts to code securely, software vulnerabilities inadvertently make their way into production and continue to be a leading cause of breaches today.
GitHub and JFrog partner to unify code and binaries for DevSecOps
As the volume of code continues to grow exponentially, software developers, DevOps engineers, operations teams, security specialists, and everyone else who touches code are increasingly spending their time in the weeds of securing, delivering, and scaling software. This bottles up creativity and ultimately slows software development for every organization.
Introducing GitHub Copilot Extensions: Unlocking unlimited possibilities with our ecosystem of partners
Today, we’re introducing GitHub Copilot Extensions to bring the world’s knowledge into the most widely adopted AI developer tool. Through a growing partner ecosystem, Copilot Extensions enables developers to build and deploy to the cloud in their natural language with their preferred tools and services, all without leaving the IDE or GitHub.com. With Copilot and now Copilot Extensions, developers can stay in the flow longer, uplevel their skills, and innovate faster.
Dependabot on GitHub Actions and self-hosted runners is now generally available
Starting today, administrators using Github.com accounts can enable their repositories and/or organizations to run Dependabot updates jobs as a GitHub Actions workflow using both hosted and self-hosted runners. Running Dependabot does not count towards GitHub Actions minutes–meaning that using Dependabot continues to be free for everyone.
CodeQL zero to hero part 3: Security research with CodeQL
I’ve written a bit in the past about static analysis (CodeQL zero to hero part 1: Fundamentals of static analysis) and basics of writing CodeQL queries (CodeQL zero to hero part 2: Getting started with CodeQL). Today, I want to dig deeper about CodeQL and talk about variant analysis, writing a taint tracking query and various techniques for doing security research with CodeQL.
A policy proposal on our approach to deepfake tools and responsible AI
We’re asking for feedback on a proposed Acceptable Use Policy update to address the use of synthetic and manipulated media tools for non-consensual intimate imagery and disinformation while protecting valuable research. We are proposing an addition to our Acceptable Use Policies on Misinformation and Disinformation to address the development of synthetic and manipulated media tools for the creation of non-consensual intimate imagery (NCII) and disinformation.
Found means fixed: Introducing code scanning autofix, powered by GitHub Copilot and CodeQL
Now in public beta for GitHub Advanced Security customers, code scanning autofix helps developers remediate more than two-thirds of supported alerts with little or no editing. Authors Starting today, code scanning autofix will be available in public beta for all GitHub Advanced Security customers.
Hard and soft skills for developers coding in the age of AI
As AI continues to shape the development landscape, developers are navigating a new frontier—not one that will make their careers obsolete, but one that will require their skills and instincts more than ever. Sure, AI is revolutionizing software development, but that revolution ultimately starts and stops with developers. That’s because these tools need to have a pilot in control.
Hard and soft skills for developers coding in the age of AI
As AI continues to shape the development landscape, developers are navigating a new frontier—not one that will make their careers obsolete, but one that will require their skills and instincts more than ever. Sure, AI is revolutionizing software development, but that revolution ultimately starts and stops with developers. That’s because these tools need to have a pilot in control.
Keeping secrets out of public repositories
By Eric Tooley & Courtney Claessens Accidental leaks of API keys, tokens, and other secrets risk security breaches, reputation damage, and legal liability at a mind-boggling scale. In just the first eight weeks of 2024, GitHub has detected over 1 million leaked secrets on public repositories. That’s more than a dozen accidental leaks every minute. Since last August, all GitHub cloud users could opt-in to secret scanning push protection, which automatically blocks commits when a secret is detected.
Meet Kayla: A college student and open source ambassador
From learner to mentor, Kayla, an All In for Students ambassador, has become an open source leader on her campus. When it comes to the GitHub All In for Students program, you need to embrace the idea of, “Coming in with an open mind,” says Kayla Partee, an All In ambassador. She joked that it seems like a bad pun when discussing the world of open source, but it’s also critical to success in this program, and to open source in general.
Keeping secrets out of public repositories
With push protection now enabled by default, GitHub helps open source developers safeguard their secrets, and their reputations. Authors Accidental leaks of API keys, tokens, and other secrets risk security breaches, reputation damage, and legal liability at a mind-boggling scale. In just the first eight weeks of 2024, GitHub has detected over 1 million leaked secrets on public repositories. That’s more than a dozen accidental leaks every minute.
Keeping secrets out of public repositories
With push protection now enabled by default, GitHub helps open source developers safeguard their secrets, and their reputations. Authors Accidental leaks of API keys, tokens, and other secrets risk security breaches, reputation damage, and legal liability at a mind-boggling scale. In just the first eight weeks of 2024, GitHub has detected over 1 million leaked secrets on public repositories. That’s more than a dozen accidental leaks every minute.
How to stay safe from repo-jacking
Repo-jacking is a specific type of supply chain attack. This blog post explains what it is, what the risk is, and what you can do to stay safe. “Repo-jacking” is a type of supply chain attack that has received attention for its potential impact on open source software. In this blog post, I’ll explain what repo-jacking is and what you can do to stay safe.
The architecture of SAST tools: An explainer for developers
In today’s age of shifting left—an approach to coding that integrates security checks earlier into the software development lifecycle (SDLC)—developers are expected to be proficient at using security tools. This additional responsibility can be overwhelming for developers who don’t specialize in security. The main issue: on top of their normal responsibilities, developers have to sift through many false positive alerts to find and address the real, critical vulnerabilities.
AppSec is harder than you think. Here’s how AI can help.
By signing up for our newsletter, you agree to our Terms of Use and Privacy Policy
AppSec is harder than you think. Here’s how AI can help.
Find vulnerabilities earlier, ship software faster. These are the good intentions behind the drive to shift application security workflows from security teams to developers: a “shift left” move in the software development lifecycle. But does it really work? In practice, shifting left has been more about shifting the burden rather than the ability. Most AppSec tools, even those that claim to be “developer-first,” require a certain degree of security expertise to deploy and use.
Do you know if all your repositories have up-to-date dependencies?
Keeping your repositories’ dependencies up to date is crucial for maintaining quality and security. Outdated dependencies can expose your project to vulnerabilities, compromise its stability, and hinder its overall performance. In order to answer this question for ourselves, we created a GitHub Action: Evergreen.
Introducing auto-triage rules for Dependabot
Since the May beta release of our GitHub-curated Dependabot policies that detect and close false positive alerts, over 250k repositories have manually opted in, with an average improvement of over 1 in 10 alerts. The impact so far: auto-dismissal of millions of alerts that would have otherwise demanded a developer’s attention to manually assess and triage.
A faster way to manage version updates with Dependabot
When the next Log4j lands, you don’t want to find out that you’re several versions behind, and that it’s going to take the team days to fix all of the breaking changes. Dependabot version updates automate the patching process, giving you a measure of protection from unwelcome surprises. But just as with any inbox, the sheer volume of available updates can quickly swell into a management hassle.
GitHub Repository Rules are now generally available
Protected branches have been around for a while, and we’ve made numerous improvements over time. We’ve added new rules to protect multiple branches and introduced additional permissions. However, it’s still challenging to consistently protect branches and tags throughout organizations. Managing scripts, cron jobs, various API calls, or third-party tooling to have consistent branch protections is not only annoying but also time-consuming.
GitHub achieves ISO/IEC 27701:2019, 27018:2019, and CSA STAR certifications
GitHub continues to invest in security, privacy, and compliance as part of our ongoing effort to be the most trusted home for all developers. As a result of that investment, GitHub’s Information Security and Privacy Management System (ISPMS) was assessed against the ISO/IEC 27701:2019 (PII Processor) and ISO/IEC 27018:2019 standards. GitHub simultaneously completed the necessary third-party assessment to achieve the Level 2 STAR Certification in CSA’s STAR Registry.
Dependabot relieves alert fatigue from npm devDependencies
Over the past few months, we’ve made a number of improvements that make Dependabot smarter, quieter, and easier to work with, from pausing pull requests on inactive repositories to making alerts visible to more developers. Today, we’re addressing the alert fatigue problem with a new allow auto-dismissal function in Dependabot that safely reduces the volume of false positive alerts that can overwhelm developers and distract from legitimate vulnerabilities.
Private vulnerability reporting now generally available Original
Today, we’re announcing the general availability of private vulnerability reporting, a private collaboration channel that makes it easier for researchers and maintainers to report and fix vulnerabilities on public repositories.
Introducing self-service SBOMs
Following the precedent set by Executive Order 14028, security and compliance teams increasingly request software bills of materials (SBOMs) to identify the open source components of their software projects, assess their vulnerability to emerging threats, and verify alignment with license policies. So, we asked ourselves, how do we make SBOMs easier to generate and share?
How to mitigate OWASP vulnerabilities while staying in the flow
The pace and scale of security vulnerabilities is increasing. This is in spite of the fact that teams have been trying to keep their code secure for years. So, why are vulnerabilities still such a problem? When teams use security tools and strategies that don’t optimize the developer experience, development is slowed down. This creates frustration, undermines customer usability, and hampers business success.
Setting the foundations for compliance
While compliance is foundational to delivering software around the world, there may be instances where developers get frustrated with policy enforcement slowing down their workflow. Since compliance is what enables the world’s software to be run across regions and enterprises with different security, data, and privacy requirements and regulations, we at GitHub are well-practiced in balancing business needs with developer happiness.
Unlocking security updates for transitive dependencies with npm
Dependabot helps developers secure their software with automated security updates: when a security advisory is published that affects a project dependency, Dependabot will try to submit a pull request that updates the vulnerable dependency to a safe version if one is available. Of course, there’s no rule that says a security vulnerability will only affect direct dependencies—dependencies at any level of a project’s dependency graph could become vulnerable.
Dependabot alerts are now visible to more developers
Dependabot alerts were launched as GitHub’s first security alerts five years ago. Since then, developers have kept dependency-based vulnerabilities out of their code with over 80 million closed alerts. Historically, Dependabot alerts have only been available to admin users, but that means the alerts aren’t visible to the developers who are responsible for fixing them.
A smarter, quieter Dependabot
In 2022, Dependabot automatically generated more than 75 million pull requests, which developers used to keep their dependencies up-to-date and to address millions of specific vulnerabilities. Moving forward, Dependabot is getting a little smarter—and, a little quieter—by reducing bot-based noise from repositories based on your interaction with Dependabot. We’ve been listening to your feedback and making Dependabot more focused on the repositories you care about.
How to mitigate OWASP vulnerabilities while staying in the flow
The pace and scale of security vulnerabilities is increasing. This is in spite of the fact that teams have been trying to keep their code secure for years. So, why are vulnerabilities still such a problem? When teams use security tools and strategies that don’t optimize the developer experience, development is slowed down. This creates frustration, undermines customer usability, and hampers business success.
GitHub’s supply chain security features now support Dart
What do applications like Google Ads, eBay Motors, and Alibaba Xianyu have in common? In addition to millions of monthly users, each was built with the popular Flutter framework that is powered by Dart. Given its rapid growth and broad adoption – and thanks to a collaboration with the Dart team at Google – GitHub supply chain security features now support the Dart developer ecosystem.
5 tips for prioritizing Dependabot alerts
Dependabot alerts can give you a superpower–the ability to secure your project by keeping dependency-based vulnerabilities out of your code. However, while all potential vulnerabilities can be an issue and warrant attention, not all vulnerabilities pose equal risk to your project. For example, some vulnerabilities have the potential to be critical, but don’t pose as much risk due to how you’re using the dependency. So, how do you assess risk across all your alerts and prioritize accordingly?
GitHub brings supply chain security features to the Rust community
GitHub’s supply chain security features help you understand what dependencies you use, be aware of vulnerabilities in those dependencies, and then patch them so you can get back to work. This helps keep your code secure. As the home for all developers, GitHub is enabling more projects to benefit from this functionality, and we now support the fastest growing language on GitHub: Rust.
Dependabot alerts now surface if your code is calling a vulnerability
Since our February ship of improvements to Dependabot alerts, Dependabot has helped developers resolve nearly 3 million alerts. Today, we’re shipping an exciting new feature which will make Dependabot alerts even more insightful. Dependabot alerts will now surface whether your code is calling vulnerable code paths, so that you can prioritize and remediate alerts more effectively.
Leveraging machine learning to find security vulnerabilities
GitHub code scanning now uses machine learning (ML) to alert developers to potential security vulnerabilities in their code. If you want to set up your repositories to surface more alerts using our new ML technology, get started here. Read on for a behind-the-scenes peek into the ML framework powering this new technology! Detecting vulnerable code Code security vulnerabilities can allow malicious actors to manipulate software into behaving in unintended and harmful ways.
Improving the developer experience for Dependabot alerts
At GitHub, we believe in providing developer-first experiences to help you keep your code secure. Since we launched Dependabot alerts nearly four years ago, we’ve alerted users on over 425 million potential vulnerabilities in their open source dependencies. Today, we’re rolling out improvements to Dependabot alerts that make them easier to understand and remediate. What’s new More descriptive Dependabot alerts We’ve made it easier to quickly assess, prioritize, and act on Dependabot alerts.
Blue-teaming for Exiv2: creating a security advisory process
This blog post is the first in a series about hardening the security of the Exiv2 project. Most of the steps that I’m taking with Exiv2 are generally applicable to other projects, so my goal is to share some tips that will hopefully help you harden the security of your own project. Sometimes, the easiest way to learn is by example. For example, I found it much easier to get started with libFuzzer by copying the setup from another project than by reading the documentation.
GitHub Advisory Database now supports Rust
GitHub is on a mission to create a more secure supply chain for all developers and organizations. To do that, we need to empower all developer communities with a comprehensive vulnerability database.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Eric
Contact Eric, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack